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An elementary derivation of best eavesdropping strategies 
for the 4 state BB84 quantum cryptography protocol is pre- 
sented, for both incoherent and two-qubit coherent attacks. 
While coherent attacks do not help Eve to obtain more infor- 
mation, they are more powerful to reveal the whole message 
sent by Alice. Our results are based on symmetric eaves- 
dropping strategies, which we show to be sufficient to analyze 
these kind of problems. 

PACS Nos. 03.65. Bz 



In the 4-state BB84 quantum cryptography protocol 
0, Alice, the transmitter^ sends qubits in states cho- 
sen at random among a set of 4 possible states S — 
{|0)z, |l)z, |0)j;, |l):r}, where the subscripts z and x de- 
note the polarization axis. At the other end of the quan- 
tum channel Bob, the receiver, analyzes the qubits in a 
basis chosen at random between {|0)2, |l)z} (2 basis) and 
{|0)x, |l)x} (a; basis). When Bob's basis happens to be 
compatible with the state sent by Alice, the only cases 
that the two partners will consider after publicly reveal- 
ing the basis used for each qubit, Bob's results are per- 
fectly correlated to the states sent by Alice. The safety 
of this protocol relies on the control of this perfect corre- 
lation and on the quantum principle that any eavesdrop- 
ping necessarily perturbs the state of some of the qubits, 
hence reducing this correlation. Alice and Bob measure 
this correlation by publicly comparing a sample of their 
data. However, there is a practical question: given a 
measured correlation, how much information could have 
been collected by a malevolent third party, called tradi- 
tionally Eve? 

The general eavesdropping attack consists of first let- 
ting an auxiliary quantum system, called the probe, in- 
teract with the message (in form of qubits) sent by Alice 
0. Then, Eve waits until she knows the basis used in 
Bob's measurements, and extracts as much information 
as possible out of her probe. Thus, a given eavesdropping 
strategy can be characterized by a pair iJA, M), where U 
is the unitary transformation used in the interaction be- 
tween Eve's probe and the message, and M. represents 
Eve's measurement. Most of the analysis of the best 
eavesdropping strategy so far have been concentrated in 
the so-called "incoherent attacks", in which each of Eve's 
probes interacts independently with each qubit sent by 
Alice. However, there might exist a better strategy for 
Eve in which her probes interact with more than one of 



Alice's qubits at the same time, what is known as "coher- 
ent attacks" . This letter provides an elementary deriva- 
tion of the optimal eavesdropping strategy for a given 
disturbance of the perfect correlation between Alice and 
Bob's data for both incoherent attacks and coherent at- 
tacks on two qubits. Our results show that coherent at- 
tacks do not help Eve to obtain more information about 
Alice message. However, they allow Eve to obtain the 
whole message sent by Alice with a higher probability. 
Thus, this is a situation where coherent attacks prove to 
be more powerful than incoherent (single qubit) ones g] 
even if no error correction or privacy amplification B is 
performed. 

Our formulation of the problem is based on what we 
will call "symmetric eavesdropping strategies" . Those 
are attacks in which Eve treats all the possible messages 
sent by Alice on an equal footing. As we show below, 
without loss of generality, one can restrict oneself to an- 
alyze symmetric eavesdropping strategies only, which re- 
duces enormously the problem. The reason is that for 
any given non-symmetric attack, coherent or incoherent, 
one can always find a symmetric one that reproduces the 
results of the non-symmetric strategy. 

This paper is organized as follows: first, we consider 
general symmetric incoherent attacks; next, we consider 
general symmetric 2-qubit coherent attacks; and finally, 
we show that the symmetric strategies are sufficient to 
study eavesdropping attacks. 

Let us analyze first the incoherent attacks. Denoting 
by \E) the initial state of Eve's probe, the unitary oper- 
ation 11 can be characterized by its action on a basis set 
of Alice states 
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where |i?f ,) are unnormalized states of Eve's probe that 
span a 4-dimensional Hilbert space. Equation (1) can be 
written in a more compact form as 
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where E^ is a 2 x 2 matrix whose elements are Eve's states 
|£'? ■). The action oiU on the basis {10)^:, |l)a;} can be 
readily derived using linearity 



1^) 



|0). 

ID. 



u 



|0). 

ID. 



(3) 



Here E^ — V£^V\ where 
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(4) 



implements the transformation from the z to the x basis. 
Let us now particularize the above equations for a sym- 
metric attack. To this aim, we note that for a given 
measurement strategy A4, the scalar products {Ef AE^ j) 
characterize the unitary operation lA of Eve's attack. In 
the present context, a symmetric attack is defined by 
imposing that all scalar products {EfAE^j) [a = x,z, 
i,j, fc, Z = 0, 1)) have to be invariant with respect to two 
operations: (i) exchange of the states ^^ 1; (ii) ex- 
change of basis z <-^ a;. This amounts to requiring that 
all possible states sent by Alice (g S) are treated on an 
equal footing. For example, the first condition (i) means 
that the probability amplitudes of any outcome should 
not depend on whether Alice prepared a |0) or a |1). It 
imposes that the scalar products should be invariant un- 
der the exchange of the subindices ^-> 1, i.e.. 
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etc, where traditionally F is called fidelity and D dis- 
turbance. The second condition (ii) means that the out- 
comes should not depend on whether Alice used the z or 
the X basis. Together with the normalization condition, 
it imposes that 



F^D = \, F-D = Fi+Di, 



(6) 



and that all the other scalar products that do not appear 
in (0) have to be zero. Thus, the number of independent 
parameters in the problem is reduced to only 2 real num- 
bers {D and Di, for example). Fixing the disturbance 
D, one can then determine any property of the attack 
(information gain, probability of success in guessing the 
qubit sent by Alice, etc) as a function of 1 parameter 
only. Therefore, best strategies can be very easily (even 
analytically) found by maximizing functions with respect 
to one parameter. 

With these notations one can rewrite Eqs. (1) in the 
following appealing form: 
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where \E^,k 

send a j 



represent Eve's (normalized) state in case 
Alice send a j bit and Bob detected a k bit. The fi- 
delity F is the probability that Bob detected Alice bit 
correctly, while the disturbance D is the complementary 
probability of wrong detection. 

Let us analyze now the measurement that allows Eve 
to extract the maximal information out of her probe. 
In principle, one should consider separately the cases in 



which Alice prepares each of the states 5, and then aver- 
age over all these cases. However, thanks to the symme- 
try, it is sufficient to consider only the situation in which 
Alice chooses the z basis. In that case, after tracing over 
Alice's particle. Eve's two possible states are: 
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The optimal measurement strategy M. for Eve is based 
on the fact that the four states that appear in the de- 
composition of these two density matrices, l-E"? ■), fall 
into two mutually orthogonal sets, Sq = {\Eq q) AE^ ■^)} 

and 5*1 = {l-E-o 1)7 l^-i.o)}' *^^* '^^'^ be therefore distin- 
guished deterministically. The first set 5*0 occurs with 
probability F, in which case Eve has to extract infor- 
mation about two states with same a priori probability 
and overlap cos(a) = Fi/F. The second set 5*1 occurs 
with probability D and state overlap cos(/?) = Di/D [gj. 
Consequently, Eve's information equals: 



Ie = l + F H{P^) + D HiPp), 



(9) 



where H{P) = Pln(P) + (1 - P) ln(l - P) is the Shanon 
entropy, and Pq = [1 -I- sin(a)]/2. The probability that 
Eve finds out the state sent by Alice is 



Pe^FP^+DP, 



a- 
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These two quantities Jg and Pg are maximum for a = /3 
(or, equivalently, Fi/F = Di/D). In this case one has 
D ^[l- cos(a)]/2, /°P* = 1 + H{Po), and P°p' = P^. 
These relations provide the explicit and analytic opti- 
mum eavesdropping strategy with a single parameter a. 
It agrees with the numerical result and the bound devised 
in p]. A complete presentation can be found in M]. In 
Fig. 1 (upper plot) we have plotted /°p*, Bob's informa- 
tion /ft, and /°P* -l-/fc as a function oi D. In the lower plot 
we represent P°p* and Bob's probability P;, = F. For dis- 
turbances below 5%, as happens in experiments [p[-|lO[, 
the information gain is proportional to the disturbance: 
le ~ 2 In (2) 13. In this case a simpler 2-dimensional probe 
suffices pTl. On the other extreme, for a — 7r/3 the dis- 
turbance is -T and the optimal information gain is 0.6454 
(0.579 for 2-dimensional probe). 

Let us conclude the analysis of incoherent attacks 
with the intriguing case when Bob's information Ib = 
1 + H{D) (probability of success Pb = 1 — -D) equals 
Eve's optimum information /°p* (P°p'). This occurs 
when cos(a) = sin(a), i.e. when a = 7r/4. Remarkably 
this coincides precisely with the threshold of violation of 
the Bell-CHSH inequality ||l|l by Alice and Bob. Indeed, 
the S parameter whose value is restricted below 2 by local 
realism, S = 2\/2cos(a) = 2 for a — 7r/4. This proves 
a conjecture presented in [|ll| . Another intriguing obser- 
vation is that /°P* -!-/&<! (see Fig. 1); that is, the sum 
of the informations gained by Eve and Bob does not add 
to 1. This is due to the fact that Eve and Bob share an 
entangled state, and perform only local measurements. 



Note however, that if Bob tells Eve the outcome of his 
measurement, then Eve can guess with certainty what 
was the qubit sent by Alice. In other words, if Bob and 
Eve are allowed to communicate one with each other, 
then, despite they do not perform joint measurements of 
the entangled state, they can determine the state sent by 
Alice. 
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FIG. 1. Upper plot; Eve's optimum information J°^*, Bob's 
information /(,, and 1°^' + J;, (dashed line) as a function of the 
disturbance D. Lower plot: Eve's (Pe) and Bob's [Ph] prob- 
ability of obtaining the message sent by Alice as a function of 
D. 



We analyze now the possibility for Eve to interact 
coherently 

with two qubits sent by Alice. We consider that Alice 
selects one of the 16 possible states among the set S — 

{|0),|0)„ |0),|1)„ |1),|0)„ |1),|1)„ |0),|0),, |0),|1)„ . . .}. 
For convenience, we use binary notation: \G)zx = 
|0),|0)„ |1),, = |1):.|0)., |2),, = |0),|1)., |3),, = 
|l)x|l)x, etc. Eve's unitary operation is characterized 
by the action of U on the basis zz 





(11) 



where f is a 4 x 4 matrix containing Eve's probe states, 
i.e.. 
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(z = 0,...,3). (12) 



Taking into account the unitarity of U^ this operation 
is characterized by 240 real numbers (which are directly 
related to the scalar products of the elements of £^^). 
By imposing the conditions of a symmetric attack, and 
without loss of generality, the number of independent 
parameters is reduced to only 5. 

The symmetric attack imposes now three conditions 
for the scalar products (i^fJI-E^^J, which are analogous 
to the ones corresponding to the incoherent attack. They 
have to remain unchanged under: (i) the exchange |0) <-> 
|1) in the first qubit or the second qubit (independently); 
(ii) the exchange of the state of the first qubit by the state 
of the second qubit; (iii) the change of the basis (i.e., zz 
to xz or zx or xx). The first condition is equivalent 
to demanding that the scalar products have to remain 
unchanged if one exchanges all the subindices 



1 ^2 



(13a) 



The second condition implies invariance if one exchanges 
simultaneously the subindices 



^^ 1 and 2 ^^ 3. 



(13b) 



Once this is satisfied, the third condition amounts to 
simply impose that {El^^El^^^ = {Ef;^\E-^i),\fi,j,k,l = 
0, ..., 3, where the matrix £^^ = (V(g) l)£^^(Vf «> 1), and 
V is defined in (^ ||l^. In more detail, let us define the 
following parameters: 

A = {E§^,\EE:o), a, = {E^%\Ef^,), A2 = {E^%\EI%), 

D / I7IZZ I rpzz \ r> / zpzz I J7>zz \ 

^ - \-^0,l 1-^0,1/' ^1 - \^0,ll-^l,0/' 
D / j^zz I rpzz \ D / rpzz I jpzz \ 

r^ / jpzz I TJ^zz \ r^ / tt'Zz I j^zz \ r^ / 7712:2: I i7'22 \ 

^ - \Ei^fi\Ei^,-i)-, ^1 - (-^0,31-^^1,2/: L.2 - (^0,3 1-^^3,0/ • 



Imposing the symmetry and unitary conditions one finds 
that: first, the scalar product (i?fJ|-E^^;) is zero if among 
the indices {i,j,k,l) either three are identical and one is 
different or two are idential and two different ||l4|] ; second, 
each of the other scalar products are identical to one of 
these parameters [|l5[ ; third, all these parameters are real 
and fulfill the following relations [analogous to (ph] 



A + 2B + C = 1, 

A-B = Ai+Bi, 

Bi — C2 = B2 + Ci 



B-C = B3 + Ci, 
Ai-A2 = B2 + B3, 



(14) 



In this way. Eve's unitary transformation is fully charac- 
terized by only 5 real parameters. 

By virtue of the symmetry, to determine Eve's distur- 
bance we can consider the case in which Alice prepared 
the state 10)^^. One readily finds D = 1- {A + B). To 
determine Eve's gain of information, we can restrict our- 
selves to the case in which Alice used the zz basis to pre- 
pare the states. The density matrices that Eve obtains 



for the 4 different choices of Ahce qubits (|0)zz, . . . , 13)22) 
can be directly read off from the Eq. (^2|) . Analogous to 
the incoherent attack case, Eve has first to distinguish 
among 4 orthogonal sets: 



So - {\Eo})) 
Si = (li^o^'i) 
S2 = {\E^:2) 
S3^{\E^o%) 



\E!:^), 
\E!%) 
\EI%) 
1^3,0) 



El%) 
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\El%) 



\El%)}. 

\Em^ 
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(15a) 
(15b) 
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which occur with probabilities A, B, B, and C, respec- 
tively. This distinction can be performed with certainty, 
since the sets are mutually orthogonal. Then she has 
to find out which element of the corresponding set she 
has. To analyze that, note that in the case of Sq and 
53, the four vectors form a pyramid with square base 
in a 4-dimcnsional Hilbert space [Fig. 2(a)], whereas 
in the case of Si and S2, they form a pyramid with 
rectangular base [Fig. 2(b)]. For So and 53 there are 
two different overlaps among the four vectors, namely 
cos(6i0 2) = Ai/A,A2/A, and cos(6if2) = Ci/C,C2/C, 
respectively. For Si and ^2 there are three different over- 



laps cos(6li2,3) = cos(6l^2.3) = Bi/ B, B2/ B, B3/ B. De- 
noting by dl {i,j — 0,..., 3) the i-th vector of the j-th 
set, we can then write the 4 vectors of any given set j in 
terms of an orthonormal (cartesian) basis eg-, ■ ■ ■ ,63 as 



fai\ 
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Vel/ 



The coefficients satisfy the following equations: 
,2 , >,2 , „2 , j2 _ 1 2(ab + cd)=cos{e{), (17a) 

2(ac + M) =005(6*1), (17b) 



a- + }f +c^ +d^ = 1, 
2(ad + 6c) =cos(6'^) 



where we choose the solutions with a > b,c, d. Here, for 
the sake of compactness we have defined 6*3' = 9{ . We 
find that the best measurement corresponds to use the 
cartesian basis. For example, if the result is 62, then take 
as a guess the corresponding state 02- 





FIG. 2. Diagrammatic representation of the states of: (a) 
sets So and 5*3; (b) sets 5*1 and 52. 



For a given set of 5 independent parameters using the 
relations (|lj) one first calculates the angles 9, as well as 
the probabilities of ending up with a given set S. Then 



one calculates the probabilities a^, &^, c^ and d^ for each 
given set by solving Eqs. {^^- Starting from these prob- 
abilities, one can determine for a given disturbance D 
the probability for Eve to find out what was the mes- 
sage sent by Alice, as well as her information gain. We 
have found analytically that the strategy that gives Eve 
the maximum amount of information coincides with the 
incoherent attack analyzed above (Fig. 1). In contrast, 
the strategy that gives her maximum probability for de- 
termining the full message (0,1,2, or 3) sent by Alice 
is different, and indeed relies on the use of a coherent 
attack. 

If Fig. 3 we have plotted Eve's and Bob's probabilities 
Pe and Pb for guessing the two qubits sent by Alice as 
a function of the disturbance, both for the optimum in- 
coherent attack P^ as well as for the optimum coherent 
attack P^ (this last, calculated numerically with a max- 
imization procedure). In the lower insert we have plot- 
ted a detail of the curves around the disturbance which 
corresponds to violation of Bell's inequalities in the inco- 
herent (single qubit) attack. In the upper insert we have 
plotted the relative gain of probability that Eve and Bob 
obtain using the coherent attack. This relative gain is 
rather small (smaller than 1.5%). For Eve it occurs at 
low disturbances, just where experiments take place. 
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FIG. 3. Bob's (Pi,) and Eve's [Pe) probabilities of guessing 
tlie two qubits sent by Alice for incoherent (Pi) and coherent 
(P2) attacks. The inserts show a detail of the curves, as well as 
the relative gain of the coherent attack. 



Let us notice that Bob could detect coherent attacks 
on successive pairs of qubit by controling the correlation 
of failures of successive qubits. However, Eve can pre- 
vent such a defense by attacking randomly chosen pairs 
of qubits, though at the cost of extra practical complica- 
tions. 

Let us conclude by sketching the proof that for a gen- 
eral case of coherent attack on n qubits (n > 1), the 
analysis of what we have defined as symmetric strategies 
suffices. To do that we show that for any given strat- 
egy {U,M} one can always construct a symmetric one 
{U^,M''} that reproduces the results for all the prop- 



erties which are defined as averages over the set S of 
possible states sent by Alice 



^ ~ 92n Z^ 



(18) 



|q)g5 



For example if Q is the probability for Eve to guess the 
result sent by Alice, then Qa would be this probability 
provided Alice has prepared the state \a). Q could also 
be Eve's or Bob's information gain, the disturbance, etc. 
The action of U is given, in general, by 

2"-l 

u\E} ® \i}, = ^ |£;.,,) ® |j%, (i = 0, . . . , 2" - 1), 

(19) 

i.e., it is characterized by a matrix £ with the states of 
Eve's probe [as in ([ll|)]. Let us denote by T one of the 
operations (acting on Alice's qubits) that we have used 
to define the symmetric attack. To be more specific, we 
take T to be an operation that: (1) Is idempotent 



T' 



1; 



(2) Leaves Alice set of states invariant 
TS^S. 



(20a) 



(20b) 



For example, the operation corresponding to exchanging 
<-» 1 in the q-th qubit (in the z basis) would be 



^|o), = |i; 



9' 



T\l), = |0) 



9' 



(21) 



whereas the one corresponding to exchanging the basis 
z <-^ a; would be T = V defined in (Q). Note that under 
these operations, £ becomes T£T. 

We now construct explicitely a symmetric attack 
{W^,7W^} with respect to T @: (i) The action oiU'^ 
is given by the matrix £^ = A={£\0) e +T£T\1) c) , where 

|0)e and |l)e are two orthogonal states of an extra ancilla 
used by Eve and £\0)e is the matrix whose elements are 
the vectors obtained by applying the tensor product to 
the elements oi £ and the vector |0)e; (ii) Eve's measure- 
ment A4^ is defined as follows: first measure the state 
of the ancilla; if the result is |0)e, then use the origi- 
nal measurement strategy M; if it is |l)e, then use the 
measurement strategy M that she would have applied if 
Alice state was prepared in the state T\a) instead of |a). 
For example, for T corresponding to the change of basis 
z '^ X, ii Bob announces publically a measurement along 
the z axis and Eve obtains |l)e, then she should mea- 
sure her probe as if Bob had announced a measurement 
in the x basis. Using (20a) one can readily check that 
{U^,M^} fulfills (£,?;.j£^) = ((T£^T),,,|(Tf^T),,), 
i.e. it is sy mmet ric with respect to T. On the other 
hand, using ( |20b| ) one obtains that regardless of the re- 
sult of the measurement on the ancilla, Ai^ will give for 
Q the same result as the one given by the non-symmetric 



strategy Ijiq). Using this procedure, one can then con- 
struct an attack {W, Ai'^} that is symmetric with respect 
to all such operations T, which it is what we have called 
a "symmetric eavesdropping strategy" . 

In conclusion, an analytic derivation of the incoher- 
ent eavesdropping strategy on the BB84 4 state quantum 
cryptography protocol that maximizes Eve's information 
has been presented. Using coherent attacks, i.e. assum- 
ing that Eve can interact coherently with more than one 
of the qubits send by Alice, seems not to improve Eve's 
information gain. This was proven for the 2-qubit case 
and we conjecture that this result hold for arbitrary co- 
herent attacks. However, our analysis shows that coher- 
ent attacks can improve the probability that Eve guesses 
correctly the entire key, at the cost of higher probability 
that Eve guess is wrong on each qubit. This provides 
another example |^,?] that coherent (sometimes called 
collective) measurements can provide results unachiev- 
able with only incoherent measurements. 
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